What is the operating system kernel, and what is the difference between user mode and kernel mode?

1. Rings, drawn

          +---------------------------------------------+
          |  user mode (ring 3 / EL0)                    |
          |   MyApi (dotnet) | nginx | sqlservr | bash   |
          +--------------------- syscall / svc ---------+
          |  kernel mode (ring 0 / EL1)                  |
          |   scheduler | memory manager | file systems  |
          |   TCP/IP stack | drivers | security          |
          +---------------------------------------------+
          |  hardware: CPU, RAM, disks, NICs             |
          +---------------------------------------------+

x64 defines rings 0–3 but mainstream OSes use only 0 and 3. Hypervisors run at a further privileged level (often described as "ring −1", or EL2 on Arm64).

2. What a fault looks like end to end

C#:   obj.Name   where obj is null
CPU:  load from address 0x0000000000000008  -> page fault (no mapping)
OS:   delivers an access violation (Windows) / SIGSEGV (Linux) to the process
CLR:  recognises the faulting instruction in managed code -> throws NullReferenceException
App:  catch block or unhandled exception handler runs

The same mechanism in native code without a runtime just kills the process.

3. Measuring user versus kernel time

High system time usually means lots of small I/O, page faults, context switches or contention in kernel locks.

4. Containers versus virtual machines

Sandboxed runtimes (for example Kata Containers or gVisor) add a VM or user-space kernel boundary when multi-tenant isolation matters.

5. Security practices tied to the boundary

• Run containers as non-root (USER app in the official .NET images since .NET 8), drop Linux capabilities, use read-only root file systems.
• Patch the host OS and kernel promptly; in AKS use node image upgrades.
• Avoid kernel-mode code unless you're writing drivers; user-mode alternatives (eBPF on Linux for observability) are safer.

6. Try it yourself

1. On Linux, run strace -c -f dotnet MyApp.dll for a simple console app that reads a file, and look at the system call summary.
2. Write a loop that writes one byte at a time with an unbuffered FileStream (bufferSize: 0 or 1), then with the default buffer; compare kernel time with pidstat or Process.PrivilegedProcessorTime.
3. In a container, run id and check whether you're root; then switch to the app user in your Dockerfile.

namespace UserKernel;

using System.Diagnostics;

public static class Program
{
    public static void Main()
    {
        string path = Path.Combine(Path.GetTempPath(), "modes.bin");

        Measure("Unbuffered, 1 byte per write", () =>
        {
            using var stream = new FileStream(path, FileMode.Create, FileAccess.Write, FileShare.None, bufferSize: 0);
            for (var i = 0; i < 200_000; i++)
            {
                stream.WriteByte(1);          // each call becomes a system call
            }
        });

        Measure("Buffered (default 4 KB buffer)", () =>
        {
            using var stream = new FileStream(path, FileMode.Create, FileAccess.Write);
            for (var i = 0; i < 200_000; i++)
            {
                stream.WriteByte(1);          // batched into far fewer system calls
            }
        });
    }

    private static void Measure(string label, Action action)
    {
        using var process = Process.GetCurrentProcess();
        var user = process.UserProcessorTime;
        var kernel = process.PrivilegedProcessorTime;
        var sw = Stopwatch.StartNew();

        action();

        process.Refresh();
        Console.WriteLine($"{label}: wall {sw.ElapsedMilliseconds} ms, " +
                          $"user {(process.UserProcessorTime - user).TotalMilliseconds:F0} ms, " +
                          $"kernel {(process.PrivilegedProcessorTime - kernel).TotalMilliseconds:F0} ms");
    }
}

# Linux: count system calls made by the app
strace -c -f dotnet UserKernel.dll